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PROPOSED AMENDMENT 



Dear Examiner Squires, 

In view of the telephone conference scheduled on 07 April 2009, 
Applicant kindly asks Examiner to consider the following proposed amendment. 
Applicant has re-written claim 1 with more clarification based on the allowable 
subject matter. 

1 1 . (Currently amended) A computer implemented method of detecting 

2 scanning attacks, comprises: 

3 adding host-pair eenneetiea-records to a 60-H.n«etien-tab4e first data 

4 structure stored on a computer readable medium when a host accesses another 

5 host during a first upda te period; 

6 at the end of a f +r st update periody accessing t h e con n e efaoR- tab l e to 

7 deter-mme-new-lw^~pairs-;--determirung the number of new host pairs added to the 

8 eormecfir^4abk> first data structure over the first update period; and 

9 aggregating records from t he first data structure into a second data 

1 0 structure which corresponds to a second update period that is greater than the first 

1 1 update period; 

12 determining the number of new host pairs added to the second data 

13 structur e over the second update period; and 

] 
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indicating a host as a scanner when at least one of the following conditions 



(i) tf-athe host h 



s in more than a first threshold number 



"CI" host pairs within the first update period , and a»-ahistoricai number of host 
pairs is smaller than the first threshold number by a first factor value "C2;" and 

(2) the host appeals in more than a second threshol d number "C4" host 
pairs within the second up date period, and a historical number of host p airs is 
smaller than the second thre shold number bva first factor value "CS." 



Shun Yao 

Park, Vaughan & Fleming LLP 
2820 Fifth Street 
Davis, CA 95618-7759 
Tel: (530) 759-3667 
Fax: (530) 759-1665 
Email: shun@parklegal.com 



By 



Respectfully submitted, 



Kbnn Y;u : r 
Registration No. 59,242 



Date: 05 April 2009 
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